Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

0apt (threat actor)

Risk

Critical

43 techniques 66 tools/malware 9 vulnerabilities 44 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1190

Exploit Public-Facing Application initial access

T1195

Supply Chain Compromise initial access

T1566

Phishing initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

T1047

Windows Management Instrumentation execution

T1053

Scheduled Task/Job execution

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1059.007

JavaScript execution

T1203

Exploitation for Client Execution execution

T1204.001

Malicious Link execution

T1068

Exploitation for Privilege Escalation privilege escalation

CVE CVE-2012-0158

CVE CVE-2017-11882

CVE CVE-2023-38950

CVE CVE-2023-38951

CVE CVE-2023-38952

CVE CVE-2024-11182

CVE CVE-2025-33053

CVE CVE-2025-44277

CVE CVE-2025-44288

›

5 Installation

T1003

OS Credential Dumping credential access

T1110

Brute Force credential access

T1016

System Network Configuration Discovery discovery

T1049

System Network Connections Discovery discovery

T1136.001

Local Account persistence

T1543

Create or Modify System Process persistence

›

6 Command & Control

T1005

Data from Local System collection

T1074

Data Staged collection

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1021.001

Remote Desktop Protocol lateral movement

T1021.004

SSH lateral movement

›

7 Actions on Objectives

T1112

Modify Registry defense impairment

T1041

Exfiltration Over C2 Channel exfiltration

T1048

Exfiltration Over Alternative Protocol exfiltration

T1486

Data Encrypted for Impact impact

T1489

Service Stop impact

T1055

Process Injection stealth

T1070.008

Clear Mailbox Data stealth

T1078

Valid Accounts stealth

T1218.005

Mshta stealth

T1497

Virtualization/Sandbox Evasion stealth

T1050

T1060

T1064

T1086

T1192

T1193

Stage risk: Critical High Medium None

Tools & Malware (66)

0APT Ransomware 0APT ransomware (Rust‑based) Akira Anubis Backdoors BlackCat Brute Ratel Brute Ratel COATHOOK Carbanak Clop Cobalt Cobalt Strike Cobalt Strike Conti Custom malware Dark DarkSide Global HTRAN Hermit Hive Jackal Kimsuky KryBit Latrodectus Downloader Latrodectus downloader LockBit Lotus Loader Lotus Loader Family Medusa MuddyWater Nexus PLAY Payload Payload PhantomCore Phishing campaigns Phishing emails PowerShell PsExec QUICKBALL Qilin QuickPulse RDP REvil REvil (Sodinokibi) Ryuk SOGU STOP Shadow copy tool ShadowPad Social engineering tactics Spear-phishing TWOCHAINS Trojan Unknown Void WMI Web Shells Wicked Winnti Zero-day exploits credential stealers such as WCE gsecdump phishing

Indicators of Compromise (44)

Domain

VfPpkd-hjZysc-RWgCYc-wQNmvb.VfPpkd-rymPhb-ibnC6b-OWXEXe-SfQLQb-aSi1db-MCEKJb.VfPpkd PnleUc.RipDKb PnleUc.qs41qe.RipDKb c-wiz.rETSD VfPpkd-aJasdd-RWgCYc-wQNmvb.VfPpkd VfPpkd-hjZysc-RWgCYc-wQNmvb.VfPpkd attack.mitre.org TEMP.Hermit +31 more

Filename

entry.client-xi9AqQZ0.js

MD5 Hash

29144c2f5acd859adf08d42ffcd74f50 fb42dec2c39cd7884ca4cb6b76308f51 0f7d721e4e5e2ce0a5c629f2fd4ac572 370fbcc6711fb983ae4679f02c5ac461

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

37 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (18)

M1013 Application Developer Guidance M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content +13 more

Exploitation (18)

M1017 User Training M1018 User Account Management M1019 Threat Intelligence Program M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions +13 more

Installation (17)

M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1025 Privileged Process Integrity +12 more

Command & Control (11)

M1018 User Account Management M1026 Privileged Account Management M1028 Operating System Configuration M1030 Network Segmentation M1031 Network Intrusion Prevention +6 more

Actions on Objectives (21)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions +16 more

Detection Coverage

37 strategies

5/7 stages covered

Delivery (6)

DET0070 Detection Strategy for Phishing across p... DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att... +1 more

Exploitation (9)

DET0066 User Execution – Malicious Link (click →... DET0094 Cross-Platform Behavioral Detection of S... DET0202 Behavioral Detection of Windows Command... DET0264 Cross-Platform Detection of JavaScript E... DET0287 Exploitation for Client Execution – cros... +4 more

Installation (6)

DET0195 Behavioral Detection of System Network C... DET0234 Credential Dumping via Sensitive Memory... DET0320 Detection of System Network Connections... DET0447 T1136.001 Detection Strategy - Local Acc... DET0463 Brute Force Authentication Failures with... +1 more

Command & Control (6)

DET0014 Detection of Data Staging Prior to Exfil... DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0327 Multi-event Detection Strategy for RDP-B... DET0380 Detection of Local Data Collection Prior... +1 more

Actions on Objectives (10)

DET0021 Behavioral Detection for Service Stop ac... DET0046 Detection Strategy for T1497 Virtualizat... DET0131 Behavioral Detection Strategy for Exfilt... DET0215 Detection of Multi-Platform File Encrypt... DET0266 Behavioral Detection of Mailbox Data and... +5 more

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

80%

0apt

Type: Criminal Sophistication: Medium Active

APT28 Jumpy Pisces first identified in 2014 0mid16B Cobalt Gang +161 more

Infrastructure 39 IOC(s)

50%

Domain

VfPpkd-hjZysc-RWgCYc-wQNmvb.VfPpkd-rymPhb-ibnC6b-OWXEXe-SfQLQb-aSi1db-MCEKJb.VfPpkd PnleUc.RipDKb PnleUc.qs41qe.RipDKb c-wiz.rETSD VfPpkd-aJasdd-RWgCYc-wQNmvb.VfPpkd +34

Artifacts (5)

entry.client-xi9AqQZ0.js 29144c2f5acd859adf08d42ffcd74f50 fb42dec2c39cd7884ca4cb6b76308f51 0f7d721e4e5e2ce0a5c629f2fd4ac572 370fbcc6711fb983ae4679f02c5ac461

Capability

52%

43 technique(s) 66 tool(s)/malware 9 CVE(s)

0APT Ransomware 0APT ransomware (Rust‑based) Akira Anubis Backdoors BlackCat Brute Ratel Brute Ratel +58

T1050 T1060 T1064 T1086 +2

collection

T1005 T1074

command and control

T1071.001 T1105

credential access

T1003 T1110

Victim

70%

Targeted Sectors

government financial-services defense telecommunications healthcare critical-infrastructure manufacturing education energy media non-profit transportation aerospace aviation retail hospitality utilities pharmaceutical construction think-tank mining gaming legal-services information-technology maritime chemical nuclear oil-gas entertainment aerospace & defense legal

Targeted Countries

US RU CN TW IR VN KR IN UA IL JP AE PK GB AU SA TR BR KP CA SG DE BY MX ES PL RO FR NG IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Criminal

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1190 T1195 T1566 T1566.001

Capability (Malware)

0APT Ransomware 0APT ransomware (Rust‑based) Akira

Infrastructure

VfPpkd-hjZysc-RWgCYc-wQNmvb.VfPpkd-rymPhb-ibnC6b-OWXEXe-SfQLQb-aSi1db-MCEKJb.VfPpkd PnleUc.RipDKb PnleUc.qs41qe.RipDKb

4 Exploitation

Capability (Techniques)

T1047 T1053 T1059 T1059.001 T1059.003

Capability (Malware)

0APT Ransomware 0APT ransomware (Rust‑based) Akira

Infrastructure

VfPpkd-hjZysc-RWgCYc-wQNmvb.VfPpkd-rymPhb-ibnC6b-OWXEXe-SfQLQb-aSi1db-MCEKJb.VfPpkd PnleUc.RipDKb PnleUc.qs41qe.RipDKb

5 Installation

Capability (Techniques)

T1003 T1110 T1016 T1049 T1136.001

Capability (Malware)

0APT Ransomware 0APT ransomware (Rust‑based) Akira

Infrastructure

VfPpkd-hjZysc-RWgCYc-wQNmvb.VfPpkd-rymPhb-ibnC6b-OWXEXe-SfQLQb-aSi1db-MCEKJb.VfPpkd PnleUc.RipDKb PnleUc.qs41qe.RipDKb

6 Command & Control

Capability (Techniques)

T1005 T1074 T1071.001 T1105 T1021.001

Capability (Malware)

0APT Ransomware 0APT ransomware (Rust‑based) Akira

Infrastructure

VfPpkd-hjZysc-RWgCYc-wQNmvb.VfPpkd-rymPhb-ibnC6b-OWXEXe-SfQLQb-aSi1db-MCEKJb.VfPpkd PnleUc.RipDKb PnleUc.qs41qe.RipDKb

7 Actions on Objectives

Capability (Techniques)

T1041 T1048 T1486 T1489

Capability (Malware)

0APT Ransomware 0APT ransomware (Rust‑based) Akira

Infrastructure

VfPpkd-hjZysc-RWgCYc-wQNmvb.VfPpkd-rymPhb-ibnC6b-OWXEXe-SfQLQb-aSi1db-MCEKJb.VfPpkd PnleUc.RipDKb PnleUc.qs41qe.RipDKb